Skip to content

docs: release notes for March 2026 program releases #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
klausundklaus wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: release notes for March 2026 program releases #29

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
343 changes: 343 additions & 0 deletions changelog.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,343 @@
---
title: "Changelog"
sidebarTitle: "Latest Releases"
description: "Latest Releases"
rss: true
---

<Update label="Programs March 2026" description="March 2026">

<Warning>
Breaking changes in this release. See the CHANGELOG for migration steps.
</Warning>

### light-system-program v2.3.0 (Mainnet)

Program hash: `581998887c26c6bda44872703b55187a435e3643293c8fd77929d562032fd04b`

`light-system-program` v2.3.0 deployed to mainnet with security fixes, new Pinocchio SDK support, and breaking SDK changes.

**Security**: `MintCloseAuthority` added to `RESTRICTED_EXTENSION_TYPES` and `has_mint_extensions()`. A mint with this extension could previously be compressed without `CompressOnly` mode, allowing the mint authority to close the mint and strand compressed tokens. Certora audit finding M-03. (#2263)

**New**: `light-account` (Anchor/Solana) and `light-account-pinocchio` crates provide framework-agnostic compressed account development. Introduces `#[derive(LightAccount)]`, `#[derive(LightProgramPinocchio)]`, and generic type aliases (`CpiAccounts`, `CompressCtx`, `DecompressCtx`, `ValidatedPdaContext`, `PackedAccounts`). (#2230)

**New**: `AccountLoader` for loading compressed accounts without derive macros. `#[light_account(init)]` now requires a `pda_rent_sponsor` account. (#2222)

**New**: `DECOMPRESSED_PDA_DISCRIMINATOR` constant (`[255u8; 8]`) in `light-compressible` marks decompressed PDA placeholder accounts. (#2208)

**Fixes**: `store_data()` owner caching corrected (#2277), v2 tree rollover balance check fixed (#2278), canonical bump enforced in ATA verification (#2249), batched address tree init asserts tree and queue index match (#2318), system program addresses corrected (#2298).

### Breaking changes in light-system-program v2.3.0

- `COMPRESSIBLE_CONFIG_SEED` renamed to `LIGHT_CONFIG_SEED`. Migration: update all references. (#2222)
- `COMPRESSIBLE_CONFIG_V1` renamed to `LIGHT_TOKEN_CONFIG`. Migration: update all references. (#2222)
- `token::authority` renamed to `token::owner_seeds` in `#[light_account]`. Owner seeds must be constants. (#2222)
- `#[light_account(init)]` now requires `pda_rent_sponsor` in instruction accounts. (#2222)
- `#[derive(Compressible)]` removed -- use `#[derive(LightAccount)]` or `#[derive(LightProgramPinocchio)]`. (#2230)

### light-compressed-token v2.4.0 (Mainnet)

Program hash: `ad43a477a97cad48b088a64ab51008c2d27b5798090330a922a588fdecec8ea1`

`light-compressed-token` v2.4.0 deployed to mainnet with a new mint creation fee and optional fee payer support.

**New**: Mint creation charges `MINT_CREATION_FEE` (50,000 lamports) forwarded to `rent_sponsor`. `CreateMintInputs` gains a required `rent_sponsor` field. Use `MintActionMetaConfig::with_rent_sponsor()` to configure the recipient. (#2309)

**New**: `revoke` and `approve` instructions accept an optional `fee_payer` account via `FEE_PAYER_IDX` const generic, with fallback to owner. (#2306)

**Fixes**: additional self-transfer validation (#2292), rent exemption check added to `create_token_account()` (#2292), `create_ata_idempotent()` guards against double-creation (#2292).

### Breaking changes in light-compressed-token v2.4.0

- `CreateMintInputs` requires a `rent_sponsor` field. Use `MintActionMetaConfig::with_rent_sponsor()`. (#2309)
- `handle_compressible_top_up()` and `process_compressible_top_up()` take a new `FEE_PAYER_IDX` const generic. `APPROVE_PAYER_IDX`/`REVOKE_PAYER_IDX` renamed to `OWNER_IDX`. (#2306)

### light-registry v2.3.0 (Devnet)

`light-registry` v2.3.0 deployed to devnet. Tree initialization functions (`create_initialize_merkle_tree_instruction`, `create_initialize_batched_merkle_tree_instruction`, `create_initialize_batched_address_merkle_tree_instruction`) now require the protocol authority as signer. The `payer` parameter is renamed to `authority`. (#2325)

V1 tree initialization logs a deprecation warning. V1 trees will be removed in a future release. (#2329)

Fixes: `init_v1_tree_with_custom_forester()` corrected (#2319), `migrate_trees_ix()` preserves in-progress work (#2320).

### account-compression v2.2.0 (Devnet)

`account-compression` v2.2.0 deployed to devnet. V1 tree initialization logs a deprecation warning. Tree default values updated to match mainnet configuration. (#2329, #2124)

</Update>

<Update label="SDK v0.23.0" description="February 2026">

### light-token v0.23.0

<Warning>
Breaking changes in this release. See the CHANGELOG for migration steps.
</Warning>

`max_top_up` removed from all instruction structs (`Transfer`, `Burn`, `MintTo`, etc.). The on-chain program defaults to `u16::MAX`. `fee_payer` is now required in instruction and CPI APIs. `get_token_account_balance()` returns `ProgramError` instead of SDK-specific errors. (#2301)

```toml
[dependencies]
light-token = "0.23.0"
```

### light-sdk-macros v0.23.0

1-byte discriminator support via `#[light_pinocchio(discriminator = [...])]`. Unified `create_accounts()` replaces multiple code generation paths for PDAs, mints, tokens, and ATAs. (#2302, #2287)

```toml
[dependencies]
light-sdk-macros = "0.23.0"
```

### light-account v0.23.0

`create_accounts()` generic function for unified PDA, mint, token, and ATA creation. (#2287)

```toml
[dependencies]
light-account = "0.23.0"
```

### light-client v0.23.0

Forester dashboard with compression improvements, pending state tracking, and eligibility checks. (#2310)

```toml
[dependencies]
light-client = "0.23.0"
```

### Other SDK crate updates

- `light-token-pinocchio` v0.23.0 - authority mutability aligned, `TransferInterfaceCpi` `fee_payer` fix. (#2301, #2294)
- `light-token-client` v0.23.0 - authority mutability aligned. (#2301)
- `light-compressed-token-sdk` v0.23.0 - authority mutability aligned. (#2301)
- `light-account-pinocchio` v0.23.0 - `create_accounts()` generic function. (#2287)

Version-only bumps: `light-token-types` v0.23.0, `light-sdk` v0.23.0, `light-sdk-types` v0.23.0, `light-sdk-pinocchio` v0.23.0, `light-program-test` v0.23.0, `photon-api` v0.56.0, `light-instruction-decoder` v0.23.0, `light-instruction-decoder-derive` v0.4.0, `light-event` v0.23.0.

</Update>

<Update label="Devnet Program v2.2.0" description="February 2026">

### light-registry v2.2.0

`light-registry` v2.2.0 deployed to devnet. Adds `init_compressible_config` xtask, fixes registry program errors, refactors forester default tree/epoch handling. (#2117, #2122, #2127, #2279)

```toml
[dependencies]
light-registry = "2.2.0"
```

</Update>

<Update label="SDK v0.22.1 Hotfix" description="February 2026">

### light-token v0.22.1

Fixes `TransferInterfaceCpi` in the LightToLight transfer path - `fee_payer` was hardcoded to `None`, causing PrivilegeEscalation errors. (#2294)

```toml
[dependencies]
light-token = "0.22.1"
```

</Update>

<Update label="SDK v0.22.0" description="February 2026">

### photon-api v0.55.0

<Warning>
Breaking changes in this release. See the CHANGELOG for migration steps.
</Warning>

`photon-api` replaces hand-written client code with progenitor-generated types from the Photon OpenAPI spec. `Configuration::new()` takes a single URL parameter now (embed API key as query param). `AccountInterface` uses photon v2 types, `ColdContext` simplified. (#2219, #2274, #2198, #2226)

```toml
[dependencies]
photon-api = "0.55.0"
```

### light-client v0.22.0

`validate_mint()` validates mint for all token accounts, not just compressible. Enforces canonical bump in ATA verification. `AccountInterface` uses photon v2 types. (#2251, #2249, #2274)

```toml
[dependencies]
light-client = "0.22.0"
```

### light-token v0.22.0

`max_top_up` defaults to `u16::MAX` instead of `0` in instruction builders. Enforces canonical bump in ATA verification. (#2279, #2249)

```toml
[dependencies]
light-token = "0.22.0"
```

### light-token-pinocchio v0.22.0

Same fixes as `light-token` v0.22.0: `max_top_up` defaults to `u16::MAX`, enforces canonical bump. (#2279, #2249)

```toml
[dependencies]
light-token-pinocchio = "0.22.0"
```

### light-sdk-macros v0.22.0

`light_program` pinocchio macro refactored. Enforces canonical bump in ATA verification. (#2247, #2249)

```toml
[dependencies]
light-sdk-macros = "0.22.0"
```

### Other SDK crate updates

The following crates are updated to v0.22.0 with `max_top_up` fix and dependency bumps:

- `light-account` v0.22.0 (#2249)
- `light-account-pinocchio` v0.22.0 (#2249)
- `light-compressed-token-sdk` v0.22.0 (#2279)
- `light-event` v0.22.0 (#2279)
- `light-instruction-decoder` v0.22.0 (#2279)
- `light-program-test` v0.22.0 (#2249)

Version-only bumps (no API changes): `light-token-types` v0.22.0, `light-token-client` v0.22.0, `light-sdk` v0.22.0, `light-sdk-types` v0.22.0, `light-sdk-pinocchio` v0.22.0, `light-prover-client` v8.0.0, `light-verifier` v10.0.0.

</Update>

<Update label="Devnet Program v2.3.0" description="February 2026">

### light-compressed-token v2.3.0

Program hash: `09ea6d03fbef7f40c9a27a2c4c6aa8358662cc8f91e2e86cb2a801683c518027`

<Warning>
Security release with multiple audit fixes.
</Warning>

`light-compressed-token` v2.3.0 deployed to devnet with security and correctness fixes:

- `max_top_up` interprets values as units of 1,000 lamports. (#2265)
- Account-level delegates can compress CTokens. (#2262)
- `MintCloseAuthority` added as restricted extension. (#2263)
- Enforces canonical bump in ATA verification. (#2249)
- `validate_mint()` validates mint for all token accounts. (#2251)
- Zeros base token bytes before init to prevent IDL buffer attack. (#2248)
- Rejects rent sponsor self-referencing the token account. (#2257)
- Rejects duplicate accounts in `convert_account_infos()`. (#2258)
- Allows closing frozen light token accounts. (#2243)
- Processes metadata add/remove actions in sequential order. (#2256)
- Validates authority on self-transfer early return. (#2252)
- Enforces mint extension checks in CToken-to-CToken decompress. (#2246)
- Accumulates delegated amount at decompression. (#2242)
- Rejects `rent_payment < 2` for CMint decompression. (#2267)
- Fixes `compress_only` amount check. (#2235)
- Fixes SPL compress transfer fee check. (#2281)

```toml
[dependencies]
light-compressed-token = "2.3.0"
```

</Update>

<Update label="SDK v0.21.0" description="February 2026">

### light-client v0.21.0

<Warning>
Breaking changes in this release. See the CHANGELOG for migration steps.
</Warning>

`LightClientConfig::new()` takes 2 parameters instead of 3. The API key is now embedded in `photon_url`. Replaces photon-api with progenitor-generated client. Adds `compressed_mint` photon API support. (#2219, #2198, #2244)

```toml
[dependencies]
light-client = "0.21.0"
```

### Other SDK updates

- `light-event` v0.21.0 - `compressed_mint` photon API support. (#2198)
- `light-program-test` v0.21.0 - `compressed_mint` photon API support. (#2198)
- `light-compressed-account` v0.10.1 - `compressed_mint` photon API support. (#2198)
- `light-token-client` v0.21.0

</Update>

<Update label="Beta Releases" description="January 2026">

### ZK Compression CLI

<Tabs>
<Tab title="npm">
```bash
npm i -g @lightprotocol/zk-compression-cli@beta
```
</Tab>
<Tab title="yarn">
```bash
yarn global add @lightprotocol/zk-compression-cli@beta
```
</Tab>
<Tab title="pnpm">
```bash
pnpm add -g @lightprotocol/zk-compression-cli@beta
```
</Tab>
</Tabs>

### TypeScript Client

<Tabs>
<Tab title="npm">
```bash
npm install @lightprotocol/stateless.js@beta
npm install @lightprotocol/compressed-token@beta
```
</Tab>
<Tab title="yarn">
```bash
yarn add @lightprotocol/stateless.js@beta
yarn add @lightprotocol/compressed-token@beta
```
</Tab>
<Tab title="pnpm">
```bash
pnpm add @lightprotocol/stateless.js@beta
pnpm add @lightprotocol/compressed-token@beta
```
</Tab>
</Tabs>

<Tip>
`TestRpc` for unit tests is built into `@lightprotocol/stateless.js`
</Tip>

### Rust Client

```
[dependencies]
light-client = "0.16.0"
light-sdk = "0.16.0"
```

## Program Development

```toml
[dependencies]
light-sdk = "0.16.0"
light-compressed-token-sdk = "0.1.0"

[dev-dependencies]
light-program-test = "1.2.1"
```


</Update>